Bluetooth: RFCOMM: Fix length errors when payload exceeds 127

hdr->length is the length of the payload, it should be
buf->len - sizeof(*hdr) - 1 or buf->len - (sizeof(*hdr) + 1)

Signed-off-by: ZhongYao Luo <LuoZhongYao@gmail.com>